[TriLUG] email content filtering

Mon Sep 2 18:11:50 EDT 2002

Jon,

We do have a site license for it, I don't know if it includes a Linux  
version of the scanner, or if that company (Trend) produces such.  I  
posted another message to the list detailing my plight on trying to  
shoehorn in a quick eval of SpamAssassin instead of going and spending  
40k on Brightmail.  Unfortunately, I think I may be too late, and  
convincing my boss that a Open Source/Free Software solution over a  
company he can pass the buck to in case something goes wrong has proven  
difficult today.

Apparently the user abuse issue has gotten so out of hand that the  
management is ready to spend a boucoup of money to remove our liability  
for harassing mail.

Please, someone tell me the grass IS greener elsewhere.  Its driving me  
completely computer bonkers.

Even if the software works, he'll balk at the lack of support from a  
corporation.  Maybe you guys could capitalize on this by providing  
contractual fee based support for SpamAssassin.

Bill

On Monday, September 2, 2002, at 05:45 PM, Jon Carnes wrote:

> For an enthusiastic description of MailScanner and how to install it:
>   
> http://www.linuxsecurity.com/articles/server_security_article-> 5098.html
>
> The mailscanner main page is:
>   http://www.sng.ecs.soton.ac.uk/mailscanner/
>
> There is a writeup of how to front-end Exchange (or any other
> mailserver) using Mailscanner off the main page.  It also has a link to
> the mail archives.
>
> Mailscanner is *not* a virus scanner. It is an application that lets  
> you
> use your purchased virus scanner to scan your incoming (and outgoing)
> email. You will need an installed virus scanner for Mailscanner to  
> work.
> If you also want it to scan for spam, you will have to pre-install
> SpamAssassin as well.
>
> Mailscanner will work with most popular Virus scanners. Note, there is
> an opensource virus scanner for Linux but you should really use a
> commercial scanner.  I used McAfee's, though Sophos seems to have the
> loyalest following among Mailscanner users.
>
> Your corporation probably has a site license for its virus scanning.
> That license should include a scanner for Linux.
>
> On Mon, 2002-09-02 at 13:42, William Ward wrote:
>> Jon,
>>
>> I looked at the SpamAssassin website and found some of the technical
>> detail you may be referring to.  Sounds like the sort of thing we need
>> to try out at my company, hopefully before Brightmail appears and  
>> sucks
>> up some more capital/expense.
>>
>> Two questions:
>> 1.  You mention a mail scanner list.  Where could I find archives for
>> this list, if you don't mind?  I'd like to read through them and see
>> how much trouble I can get into creating a test box.
>> 2.  You also mentioned a solution for virus scanning?  Is this a Linux
>> open source product, or a commercial product for Linux?  We're also
>> using Trend VirusWall for our malicious code filtering, and its a
>> headache to administer.
>>
>> To the rest of the list:
>> I think it'd be great to hear what some of you other mail admins have
>> done to implement spam/virus filters in your mail handlers to prevent
>> the end-user folks from popping open each attachment that slides down
>> the pipe.  My goal is to see what open source/free software solutions  
>> I
>> can use to replace costly and unreliable commercial solutions we
>> currently use.  In the process maybe I can cut back on the amount of
>> pointless overhead one of my poor admin peers has to do on a daily
>> basis.
>>
>> Thanks,
>> Bill
>>
>>
>> On Sunday, September 1, 2002, at 05:34 PM, Jon Carnes wrote:
>>
>>> I ran SpamAssassin as a daemon on an older PC (650Mhz, 768Mb RAM) and
>>> it
>>> easily handled 8,000 emails/day.  I estimate that if we raised the  
>>> RAM
>>> to a full 1Gb then the box could easily have handled three times that
>>> amount of mail. There were around 180 individual accounts, and  
>>> probably
>>> 500 corporate alias/group accounts.
>>>
>>> Folks on the Mail Scanner list report scanning up-wards of 250,000
>>> emails/day on their systems, and in this case they are scanning both
>>> for
>>> viruses and for spam.
>>>
>>> If you overload a system that is running SpamAssassin by throwing too
>>> much mail at it, then the mail will simply queue up. Normal latency
>>> (for
>>> the system I set up at my former employer) added an average of 5
>>> seconds
>>> to incoming email.  Of course you only test incoming email... The  
>>> peak
>>> latency was around 25 minutes - with the peak occurring late at  
>>> night.
>>>
>>> SpamAssassin is really quite amazing.  We've talked about it on this
>>> list before, so I won't repeat the details again, but if you want  
>>> more
>>> info, drop me line and I'll be happy to describe how it works in  
>>> detail
>>> for you.
>>
>> _______________________________________________
>> TriLUG mailing list
>>     http://www.trilug.org/mailman/listinfo/trilug
>> TriLUG Organizational FAQ:
>>     http://www.trilug.org/~lovelace/faq/TriLUG-faq.html
>
>
> _______________________________________________
> TriLUG mailing list
>     http://www.trilug.org/mailman/listinfo/trilug
> TriLUG Organizational FAQ:
>     http://www.trilug.org/~lovelace/faq/TriLUG-faq.html
>
>